Interactive Attack Demo
See how AARSM would have prevented the postmark-mcp attack in real-time. Watch our AI security monitor block malicious email exfiltration.
The Attack: postmark-mcp Backdoor
A trusted email tool turns malicious, silently copying all emails to an attacker-controlled server.
- 15,000+ emails stolen daily
- 300+ organizations affected
- Zero detection by traditional tools
AARSM Protection
Real-time SSL interception detects and blocks malicious email destinations instantly.
- <1 second response time
- Zero data exfiltration
- Immediate alert generation
How AARSM Prevents This Attack
Our multi-layer security approach catches attacks that traditional tools miss
SSL Interception
eBPF uprobes intercept SSL_write() calls before encryption, giving us visibility into the actual email content and headers.
SSL_write() → "bcc: phan@giftshop.club"
🚨 POLICY VIOLATION DETECTED
Policy Evaluation
Real-time policy engine checks email destinations against whitelist. Unauthorized BCC recipients are instantly flagged.
giftshop.club ∉ allowed_domains
Action: BLOCK + ALERT
Immediate Response
Network connection blocked, process terminated, and security team alerted - all within milliseconds of the attempt.
Connection: TERMINATED
Alert: SENT
Time: 0.12 seconds
The Result: Complete Protection
While 300+ organizations lost sensitive data, AARSM would have prevented every single attack.